The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted data (specifications and ticket bodies) to generate executable test logic.
Ingestion points: The skill reads the 'spec' (ticket's body) and 'approved interface' (committed stubs) as primary inputs in SKILL.md.
Boundary markers: There are no explicit boundary markers or instructions to ignore malicious directives embedded within the processed specification text.
Capability inventory: The skill has the capability to write files (SKILL.md Step 4) and execute shell commands to run tests (SKILL.md Step 6).
Sanitization: No sanitization or escaping of the input specification text is described before it is used to name tests and generate test bodies.
[COMMAND_EXECUTION]: The skill explicitly instructs the AI agent to execute shell commands to run the generated tests and verify their failure reasons.
Evidence: SKILL.md Step 6 ('Run them and confirm every test is red') and the 'Command' field in the report template. This involves invoking local test runners like Vitest or Playwright.
Evidence: The skill includes a shell script scripts/check-locked-tests.sh which executes git log and git diff to verify if 'locked' files have been altered.
[DYNAMIC_EXECUTION]: The skill utilizes dynamic execution by generating source code files at runtime and subsequently executing them.
Evidence: SKILL.md Step 4 describes writing tests for acceptance, properties, contracts, and end-to-end layers using provided reference templates. These files are then executed in Step 6.

tester